← Back to Auravoid
Privacy Policy
Last Updated: June 10, 2026
This Privacy Policy describes how Auravoid LLC ("we," "us," or "our") collects, uses, and protects your information when you use the Auravoid platform ("the Service"). By using the Service, you agree to the practices described in this policy.
1. Information We Collect
1.1 Account Information
When you create an account via Firebase Authentication, we collect:
- Email address
- Display name (chosen by you)
- Authentication tokens and user ID
1.2 Gameplay Data
We automatically collect gameplay telemetry to improve the game experience:
- Scores, wave progress, kill counts, and combo statistics
- Chassis and mutation selections
- Session duration and play frequency
- Game settings and preferences
- AI Director interaction data
1.3 Payment Information
Payments are processed by our online reseller and Merchant of Record, Paddle.com (for Card/Apple Pay/Google Pay orders) or directly via PayPal secure REST endpoints. Paddle.com is the Merchant of Record for card orders, and PayPal is the processor for PayPal orders. We never directly collect, store, or process your credit card number, bank account details, or other financial account information. Paddle and PayPal handle payment data under their respective privacy policies. We receive only:
- Transaction confirmation (success/failure)
- Purchase amount and item purchased
- Your Paddle customer ID or PayPal transaction/order ID (for refund processing)
1.4 Audio and Microphone Data
Important: Certain optional features (Acoustic Transceiver, Voice Commands) require microphone access. We will always ask for your explicit consent before activating any microphone feature. You can decline and still play all games without microphone features.
When you opt in to microphone features:
- Acoustic Transceiver: Processes ultrasonic audio signals for device-to-device data transfer. Audio is processed locally on your device and is not uploaded to our servers.
- Voice Commands: Audio is processed locally for command recognition. Raw audio is not stored or transmitted.
1.5 Device and Technical Information
- Browser type and version
- Operating system
- Screen resolution and device pixel ratio
- IP address (for rate limiting and security)
2. How We Use Your Information
| Purpose | Data Used |
|---|
| Gameplay and matchmaking | Account info, gameplay stats |
| AI-powered features (Director, Observer, Oracle) | Gameplay telemetry sent to Google Gemini AI |
| Leaderboards and rankings | Display name, scores |
| Payment processing | Transaction data via Paddle & PayPal |
| Cloud Revenants (async multiplayer) | Chassis, run stats, score |
| Game balance and difficulty | Aggregated gameplay statistics |
| Bug reports and moderation | User reports, context data |
| Security and anti-abuse | IP address, auth tokens |
3. Google User Data Disclosure
3.1 Google Data Accessed
When you sign in to Auravoid using "Sign in with Google" (via Firebase Authentication), we access the following Google user data:
- Email address — Your Google account email, used as your unique account identifier.
- Display name — Your Google profile name, used as your default in-game callsign (you can change it at any time).
- Profile photo URL — Your Google profile photo URL, which may be displayed on your in-game profile.
- Google User ID (UID) — A unique identifier provided by Firebase Authentication, used to associate your game progress, scores, and purchases with your account.
We do not access your Google contacts, Google Drive files, Gmail messages, Google Calendar, Google Photos, or any other Google service data beyond what is listed above.
3.2 How We Use Google Data
| Google Data | Purpose |
|---|
| Email address | Account identification, login, password recovery, and critical account notifications (e.g., purchase receipts). We do not send marketing emails. |
| Display name | Default in-game callsign on leaderboards and multiplayer lobbies. Users can override this with a custom name. |
| Profile photo URL | Optional display on the player's in-game profile card. Not shared with other players. |
| User ID (UID) | Links your cloud save data, purchases (Grav-Tokens), leaderboard entries, and gameplay telemetry to your account. |
3.3 Google Data Sharing
We share Google user data with the following categories of third parties, and only for the purposes described:
| Third Party | Data Shared | Purpose |
|---|
| Google Firebase (Firestore, Auth) | UID, email, display name | Authentication, cloud save storage, and database operations. Firebase is the infrastructure provider. |
| Google Gemini AI | None (only anonymized gameplay telemetry) | AI-powered gameplay features. No Google account data is sent to Gemini — only gameplay statistics (scores, wave data, chassis). |
| Paddle / PayPal | Email address (at time of purchase) | Payment processing and receipt delivery. Shared only when you initiate a purchase. |
We do not sell, rent, or trade your Google user data to any third party. We do not use Google user data for advertising, profiling, or any purpose unrelated to the Auravoid game service.
3.4 Google Data Storage & Protection
- Storage location: Google user data is stored in Google Cloud Firestore (us-east1 region) and Firebase Authentication, both operated by Google under their enterprise security standards.
- Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest (Google Cloud default encryption).
- Access control: Server-side Firestore Security Rules ensure that each user can only read and write their own data. Admin access is restricted to authenticated service accounts.
- HMAC verification: Token balances are signed with HMAC-SHA256 to prevent tampering.
- App Check: Firebase App Check is enforced to verify that requests originate from the legitimate Auravoid application.
3.5 Google Data Retention & Deletion
- Active accounts: Google user data is retained for as long as your account is active.
- Inactive accounts: Accounts with no login activity for 24 months may be flagged for deletion. We will attempt to notify you via email before deletion.
- Deletion requests: You can request complete deletion of your Google user data at any time by emailing [email protected]. Upon receiving a valid request, we will:
- Delete your Firebase Authentication account
- Delete all associated Firestore documents (profile, scores, purchases, telemetry)
- Confirm deletion via email within 30 days
- Revoke access: You can revoke Auravoid's access to your Google account at any time via your Google Account permissions page.
3.6 Limited Use Disclosure
Auravoid's use and transfer to any other app of information received from Google APIs will adhere to the
Google API Services User Data Policy, including the Limited Use requirements.
4. Third-Party Services
We use the following third-party services that may process your data:
| Service | Purpose | Privacy Policy |
|---|
| Google Firebase | Authentication, database, hosting | Link |
| Google Gemini AI | AI-powered gameplay features | Link |
| Google Analytics (GA4) | Usage analytics and performance monitoring | Link |
| Paddle | Payment processing & Merchant of Record | Link |
| PayPal | Payment processing & Checkout gateway | Link |
We send gameplay telemetry data (scores, chassis, wave data — never personal identifying information) to Google's Gemini AI to generate dynamic gameplay content such as AI Director responses, sector briefings, and balance adjustments.
5. Data Storage and Security
Your data is stored using:
- Firebase Firestore: Account profiles, scores, purchases, gameplay data
- Browser localStorage: Game settings, tutorial progress, session preferences
We implement industry-standard security measures including HTTPS encryption, Firebase Authentication, server-side input validation, and rate limiting to protect your data.
6. Data Retention
- Account data: Retained while your account is active. Deleted upon request.
- Gameplay telemetry: Retained for up to 12 months for balance analysis, then aggregated and anonymized.
- Payment records: Retained as required by tax and financial regulations (typically 7 years).
- localStorage data: Controlled by you via your browser settings.
7. Your Rights
7.1 All Users
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Opt out of microphone features at any time
- Export your gameplay data
7.2 European Union (GDPR)
If you are in the EU/EEA, you have additional rights under the General Data Protection Regulation:
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to data portability (Art. 20)
- Right to object (Art. 21)
- Right to restrict processing (Art. 18)
Our legal basis for processing is: (a) performance of a contract (gameplay services), (b) legitimate interest (security, analytics), and (c) consent (microphone features, AI data processing).
7.3 California (CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it's used
- Request deletion of your personal information
- Opt out of the sale of personal information
We do not sell your personal information.
8. Children's Privacy
Auravoid is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.
9. Cookies and Local Storage
We use browser localStorage (not traditional cookies) to store:
- Firebase Authentication session tokens
- Game settings and preferences
- Tutorial completion status
- Grav-Token balance cache (authoritative balance is server-side)
You can clear this data at any time through your browser settings. Clearing localStorage will log you out and reset your local preferences.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice within the game or updating the "Last Updated" date above. Your continued use of the Service after changes constitutes acceptance of the updated policy.
11. Contact Us
For privacy-related questions, data access requests, or data deletion requests:
We will respond to all requests within 30 days (or sooner as required by applicable law).